Antitrust and Unfair Competition Law
CCPA Status Update
Gretchen A. Ramos
Co-Chair Data, Privacy & Cybersecurity Practice, Greenberg Traurig, LLP
While the California Consumer Privacy Act (CCPA) has an effective date of January 1, 2020, there are several bills to amend the law currently pending in the California Legislature that could be signed into law by October. In July, the California Senate Judiciary Committee voted on several bills that would amend the CCPA, and below is a table summarizing the status of the key amendments. The bills that passed will be on the Senate floor for a vote when the Senate reconvenes on August 12. The Senate will have until September 13 to pass the bills.
Prior to passing Assembly Bill (AB) 25 and AB 1564, the Senate Judiciary Committee amended the bills. Thus, if the Senate passes these bills, they will be subject to an Assembly vote for “concurrence” prior to moving to the Governor. The overwhelming majority of legislation that is passed is approved by concurrence vote; however, if the concurrence vote fails because there is a disagreement between the two houses, the bill will go to a conference committee. In California, conference committees are seldom used. Assuming the bills pass the Senate and are approved by a favorable concurrence vote, the Governor has until October 13 to sign the bills.
AB 25 Status. While the Assembly-approved version of AB 25 completely carved out employees, job candidates, owners, directors, officers, contracts and medical staff members from the definition of consumers, the Senate Judiciary Committee brought these categories of individuals back within the scope of the “consumer” definition. The approved bill requires businesses to inform these categories of individuals of the personal information collected about them and why it is collected. While these categories of individuals will be able to assert a private civil action for data breaches, none of the other CCPA rights will apply to them if the business only uses their personal information in relation to their role with the business. AB 25’s amended language is available here.
Key Take Away: To the extent your business has not started compiling a list of the personal information collected about your employees, job candidates, owners, directors, officers, contractors and medical staff members, you should consider adding this to your CCPA task list. Assuming AB 25 is approved, your organization will also need to prepare notices of such information handling practices to be shared with these categories of individuals.
AB 1564 Status. AB 1564 was also amended prior to being approved by the Senate Judiciary Committee. While the Assembly-approved version of AB 1564 permitted one method for submitting requests for information, the bill approved by the Senate Judiciary Committee now requires any business with a physical store front (regardless of whether they operate online too), to provide consumers with two or more designated methods for submitting requests – including a toll-free telephone number. The approved bill permits a business that operates exclusively online to provide only an email address for submitting information requests. AB 1564’s amended language is available here.
Key Take Away: To the extent your business has a physical store front, you may want to start considering the procedures your organization will put in place to handle receiving requests for information and verifying the individuals making such requests are California consumers via a phone call.
Key CCPA Amendments
| Name/Bill#/Status | Date/Sponsor | 7.9.19 Results | Description |
| Consumer Privacy AB 25 | Dec. 3, 2018; amended 6.28.19 Chau (D) | Passed – amended | • As amended, will require employers to tell worker what type of information they are collecting about them and why; while employees will have private right of action for data breach they will have no other rights • This provision will expire January 2021 |
| Customer Loyalty Programs, AB 846 | Feb. 20, 2019 Burke (D), amended 5.20.19 | Passed | • Clarifies the intent of the financial incentives exception to the non-discrimination provision was to allow businesses to offer customer loyalty programs (such as rewards, coupons, points, etc.) |
| Publicly Available information, AB 874 | Feb. 20, 2019 (Irwin), amended 3.25.19 | Passed | • Clarifies personal information does not include deidentified or aggregate consumer information |
| Personal information AB 1355 | Feb. 22, 2019 Chau (D) | Passed | • General clean-up of various typos |
| Consumer privacy request for disclosure methods, AB 1564 | Feb. 22, 2019 Berman (D) | Passed – amended | • Assembly-passed version sought to change the requirement that a business provide two or more designated methods for submitting requests for information • Senate Judiciary-passed version requiring two methods for submitting information requests, including a toll-free phone number but only for businesses with brick and mortar store; no toll-free phone number requirement for businesses that are only website based |
| Deidentified PI, AB 873 | Feb. 22, 2019 Chau (D), amended 5.2.19 | Did Not Pass (3-3 vote) | • Proposed changes to definition of deidentified information |
| Business: collection and disclosures of PI AB 1416 | Feb. 22, 2019 Cooley (D) | Pulled by author | Sought to establish CCPA exceptions, so as not to restrict a business’s ability to: • Comply with any rules or regulations • Exercise, defend, or protect against legal claims • Prevent, investigate, report, prosecute fraud, security incidents • To assist another person or government agency to conduct specified activities |
Gretchen A. Ramos, CIPP/E/US, CIPM, is a shareholder in Greenberg Traurig, LLP’s San Francisco office and Co-Chair of the firm’s Data, Privacy & Cybersecurity Practice. She may be reached at ramosg@gtlaw.com. The views she expresses are her own and not those of Greenberg Traurig, LLP or its clients.